Photo by Clint Patterson on Unsplash
There is a version of this conversation that happens in small businesses across the UK every week. A cyber incident makes the news. Someone in the team says, "we have antivirus, we're covered." Everyone nods and moves on. And in almost every one of those conversations, nobody has actually checked whether the antivirus is current, whether the licence is still active, or whether the software is still capable of recognising the threats being used today -- not the threats that existed when it was first installed.
That gap between having antivirus and being protected by antivirus is where real attacks get in.
What Outdated Antivirus Actually Looks Like in Practice
Traditional antivirus works by recognising patterns. It compares files and behaviour against a database of known threats. That database needs updating constantly -- new malware variants appear daily, sometimes in their thousands. If your definitions are even a few weeks behind, there are threats the software will simply not recognise.
But it is not just the threat database that goes stale. The antivirus engine itself also needs to be kept current. Older versions of security software carry their own vulnerabilities. Attackers actively look for businesses running dated endpoint tools, because those tools have known weaknesses that can be bypassed or exploited. State-linked threat actors and financially motivated criminal groups alike have been documented using outdated security software as an entry point -- not because it requires sophisticated skill, but because it is a reliable gap that too many businesses leave open.
Why This Is a Bigger Problem Than It Was Five Years Ago
Modern threats do not work the way threats did when signature-based detection was the industry standard. Today's malware is frequently designed to evade pattern matching entirely. It may operate only in memory, leaving nothing on disk for a scanner to find. It may use legitimate system tools to carry out its work so it appears as normal business activity. It may sit dormant for weeks before doing anything visible.
An antivirus product that has not been updated cannot recognise these techniques. But even a fully current traditional product can struggle with them, because the underlying approach itself has real limits. This is why next-generation antivirus has moved well beyond signature matching -- using behavioural analysis, machine learning, and live threat intelligence to catch what a definition file would miss. If your business is still running a basic, signature-only product that nobody is actively monitoring, you have coverage that looks like protection on paper but provides much less in practice.
The Problem With Assuming It All Runs Automatically
Most antivirus products attempt to update themselves automatically. In theory, this means you should not have to think about it. In practice, automatic updates fail more often than people realise. A device that was offline when an update ran. A laptop that travels home with a staff member and never connects to the office network long enough to pull the latest definitions. A server where reboots are deferred for months because nobody wants to interrupt a process. A licence that quietly expired and stopped pulling updates without triggering any obvious alert on screen.
Without centralised endpoint management, there is no reliable way to confirm that every device in your business is running current protection. You are left trusting that automation worked on every machine, every time. That is a reasonable hope. It is not a security control.
What Keeping Endpoint Protection Current Actually Requires
For a UK small business, keeping antivirus genuinely effective involves a few things working together:
- Security software that is actively maintained -- both the threat definitions and the engine
- A management layer that gives you a single view across all devices so you can confirm updates have landed
- Behavioural detection that does not rely solely on matching known threats
- Licences that are in date -- an expired licence is not protection, regardless of what the software still shows on screen
- A regular check that protection is active, not just installed
It is worth reading how even well-resourced organisations get caught out by the basics -- because the lesson there applies directly to endpoint protection. The failure mode is almost never a sophisticated technical gap. It is a routine control that was assumed to be running.
A Practical Starting Point
If you want to know whether your current setup is doing its job, start here:
- Open the antivirus console on each device and check the last update timestamp for both the engine and the definitions
- Check the licence expiry date -- this is often buried in settings and not shown on the main screen
- Confirm that real-time protection is active, not paused or disabled
- Ask your IT contact when the endpoint software was last reviewed as fit for purpose -- not just "is it running" but "is it the right tool for the threats that exist now"
If you cannot answer those questions quickly, or the answers are not reassuring, that is a practical starting point for a conversation. The endpoint security controls that matter most are not complicated -- they just need to be actively maintained rather than installed once and left. The businesses that get caught are not unlucky. They are carrying an assumption that was never checked.